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Coin flipping is a cryptographic primitive in which two distrustful parties 
wish to generate a random bit in order to choose between two alternatives 1 . 
This task is impossible to realize when it relies solely on the asynchronous 
exchange of classical bits: one dishonest player has complete control over 
the final outcome. It is only when coin flipping is supplemented with quan- 
tum communication that this problem can be alleviated 2-6 , although par- 
tial bias remains 7 ' 8 . Unfortunately, practical systems are subject to loss of 
quantum data 9 , which restores complete or nearly complete bias in previous 
protocols 2-61011 . We report herein on the first implementation of a quantum 
coin-flipping protocol that is impervious to loss. Moreover, in the presence of 
unavoidable experimental noise, we propose to use this protocol sequentially 
to implement many coin flips, which guarantees that a cheater unwillingly 
reveals asymptotically, through an increased error rate, how many outcomes 
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have been fixed. Hence, we demonstrate for the first time the possibility of 
flipping coins in a realistic setting. Flipping quantum coins thereby joins 
quantum key distribution 1213 as one of the few currently practical applica- 
tions of quantum communication. We anticipate our findings to be useful 
for various cryptographic protocols and other applications, such as an online 
casino, in which a possibly unlimited number of coin flips has to be performed 
and where each player is free to decide at any time whether to continue play- 
ing or not. 

Coin flipping is the art of tossing a coin to allow two parties to choose be- 
tween two alternatives in the least biased way. The importance of this primitive 
led Manuel Blum to introduce "coin flipping by telephone", in which the two spa- 
tially separated parties do not necessarily trust each other but still wish to ensure 
that the outcome is unbiased 1 . Throughout this Letter, we only consider asyn- 
chronous protocols, which consist of a sequence of rounds in which Alice and 
Bob alternate in sending classical messages to each other. For any classical coin- 
flipping protocol, one of the parties has the possibility to deterministically choose 
the outcome, in which case we say that the protocol is broken. 

In the quantum world, this is no longer true 2 6 . While no protocol with zero 
bias can exist 7 8 , the probability for a cheater to fix the outcome can be asymptot- 
ically reduced to l/y/2 70. 7% 6 . Thus, quantum communication allows one to 
implement a cryptographic primitive that is impossible using only classical com- 
munication. 

The typical structure of most previous protocols is as follows. Alice sends a 
quantum state to Bob, chosen from an agreed upon set, that conceals a bit a. 
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Bob returns a classical bit b. Alice then discloses which \ip) was sent, thereby 
revealing a. The outcome c of the coin flip is the exclusive OR of a and b, denoted 
c = a © b. For quantum to be better than classical coin flipping, Bob must not be 
able to determine the value of a with certainty from a measurement of \ip) before 
returning his bit. Furthermore, Alice must not be able to declare a value of a that 
depends on the value of b without risking being caught cheating through Bob's 
measurement of\ip). 

As usual in quantum communication, quantum states are encoded into pho- 
tons, which are susceptible to loss in the transmission channel and measurement 
apparatus. If Bob's measurement happens after Alice revealed her bit, this allows 
him to cheat by pretending that the photon was lost whenever he is not happy 
with a. Moreover, in any realistic implementation, which includes imperfect state 
preparation and noisy transmission channel and detectors, a cheating Bob can al- 
ways pretend that his measurement did not confirm Alice's declared state \ip). If 
Alice allows the protocol to be restarted until Bob declares that he is satisfied, the 
latter can always completely control the outcome 9 . 

A protocol that is not broken in the presence of loss was recently obtained 11 . 
The improvement is, however, marginal as Alice can still choose the outcome with 
near certainty in a realistic setting. Moreover, the bias increases with loss. To be 
of practical use, a protocol should be loss tolerant, which we define as being 
impervious to loss. 

In this Letter, we present the first experimental demonstration of a loss- 
tolerant coin-flipping protocol along with the optimal cheating strategies for Alice 
and Bob. The complete theoretical description and analysis of this protocol, 



3 



including the proofs for the optimality of the cheating strategies, is presented 
elsewhere 14 . We also propose a new task for which this protocol remains use- 
ful in the presence of experimental noise. Hence, we demonstrate for the first 
time the possibility of flipping coins in a realistic setting. Flipping quantum coins 
thereby joins quantum key distribution 12 ' 13 as one of the few currently practical 
applications of quantum communication. 

Let us first describe our protocol when both parties are honest. Alice sends 
a qubit whose state \tp Xia ) is chosen randomly among the following, previously 
agreed upon set (see Fig. 1): 
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where \(p + ) = cos</?|0) + sin</?|l), \(p~) = sin</?|0) — cos</?|l) and 0° < (p < 45°. 
Here, x and a represent Alice's basis and bit, respectively. Bob then attempts to 
measure Alice's qubit in a basis y E {0,1} from the set described above, chosen 
at random. If Bob does not detect the qubit, he asks Alice to send another ran- 
domly selected state. If Bob detects the qubit, he sends a random bit b to Alice. 
When Alice receives b, she reveals x and a to Bob. If y — x, Bob's measure- 
ment outcome should agree with Alice's declared state \tp x ,a), m which case a is 
accepted. In case of a disagreement, Bob declares a mismatch. If y ^ x, Bob has 
no way to verify Alice's claim with certainty and he must accept her bit on faith. 
The outcome of the protocol is c = a © b. 

The loss tolerance of our protocol stems from two features. The first is that 
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Bob's measurement happens before Alice reveals her bit a. The second is that Bob 
gains no advantage in falsely declaring that Alice's qubit was lost. In particular, it 
is physically impossible for Bob to determine Alice's bit a with certainty, given a 
single copy of \ift x ,a)- The performance of optimal cheating strategies depends on 
the value of (p. For the states given in Eq. ([T]) with ip = 45°, which we refer to as 
the BB84 states (see Fig. 1-a), Alice's maximum probability to fix the outcome, 
Pa, is (6 + \/2)/8 « 92.7%; she is caught cheating with the complementary 
probability, i.e. when a mismatch occurs. Bob's equivalent probability, Pb, is 
(2 + V2)/4 « 85.4%, which makes the use of these symmetrically distributed 
states unfair as Alice can cheat better. By setting if = arccos(4/5) ~ 36.9°, which 
results in what we call the fair states (see Fig. 1-b), this asymmetry is removed, 
leading to Pa = Pb = 90%. For both sets of states, Alice's optimal cheating 
strategy consists of randomly sending one of the two orthogonal states \A ) and 
\Ai) that are positioned symmetrically between states representing different bit 
values a, as shown on Fig. 1 . This choice allows her to always declare an x and 
a that will produce the outcome of her choice while minimizing her probability 
of being caught cheating. Bob's optimal cheating strategy consists of measuring 
the received qubit in basis {|-£>o)? |-Bi)}, where \Bi) is positioned symmetrically 
between the states that correspond to the bit value a = i, as shown on Fig 1. This 
maximizes his probability to guess the value of Alice's bit. Note that we do not 
consider the case in which both Alice and Bob are cheating, as the goal of the 
protocol is to protect the honest player only. 

The resulting protocol is impervious to loss. However, it is not tolerant to 
noise on a single coin flip. Indeed, in case of a mismatch, Bob cannot know with 
certainty if it is caused by a cheating Alice or by noise in the state preparation, 



5 



transmission or detection. In fact, all known protocols for flipping a single coin 
are broken in the presence of noise 9 and it remains an open question whether such 
a noise-tolerant protocol exists at all. We propose considering a different task: 
Alice and Bob need to flip many coins, possibly an unlimited number, and have 
the possibility to stop playing whenever they want and for whatever reason, in- 
cluding that they no longer trust the other player. This scenario might apply to 
an online casino where the client and the house do not trust each other but may 
still wish to play indefinitely. According to this task, which we shall call sequen- 
tial coin flipping, each player can secretly decide, given sufficient statistics, the 
maximum tolerable error rate (the rate at which mismatches occur). Obviously, 
this threshold should be smaller than the rate induced solely by optimal cheating 
and larger than the intrinsic error rate of the experimental setup. The observed 
error rate asymptotically reveals how many coin flips the cheater was able to fix, 
a measure that is impossible to assess in a single coin flip. Note, however, that se- 
quential coin flipping requires a loss-tolerant single coin-flipping protocol such as 
ours. Otherwise, the cheater would exploit losses to fix the outcome, as discussed 
above, instead of pursuing the strategy that involves falsely declaring a mismatch. 
We stress the difference between sequential coin flipping and random bit-string 
generation, in which Alice and Bob generate at once a random string of bits with 
predetermined length 9 . Indeed, this string cannot be used for sequential coin flip- 
ping as the players know in advance all the bits of the sequence, hence they can 
decide when to stop depending on the outcome of future coin flips. Whereas ran- 
dom bit-string generation can be done classically 15 , we conjecture that sequential 
coin flipping cannot as it would be composed of many individual coin flips that 
can be broken by a potential cheater. 
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For the experimental implementation of the protocol, the restrictions on 
Alice's qubit source are very stringent, even more than in the closely related prim- 
itive of quantum key distribution 12 ' 13 ' 16 , as Bob is an adversary who is potentially 
cheating. In particular, if Alice is using attenuated laser pulses, then Bob can eas- 
ily break the protocol using his honest measuring apparatus, as discussed in the 
Methods. With current technology, Alice's only practical choice is to use a source 
of entangled qubits. Projecting one qubit at Alice's remotely prepares a random 
state on the second qubit being sent to Bob 17 . 

Our experimental setup is detailed in Fig. 2. Time-bin entangled photonic 
qubits 18 in the state 

\^ + ) = ^=(\e) A \e) B + \e) A \£) B ) (2) 

are created, where \e)A{B) and \£)a(b) represent the early and late time-bin states 
of Alice (Bob) and are associated to the generic states |0) and |1) used above to 
describe the protocol. One qubit remains in Alice's laboratory where it is ran- 
domly projected on one of the four states defined in ([T|) using a novel free-space 
universal time -bin analyser (UTBA) (see the Methods for more details). This has 
the effect of remotely preparing the other qubit in the same state. The latter is sent 
to Bob over the fibre communication link, which consists of 10 m of polarization 
maintaining (PM) fibre. Note that the PM fibre can be replaced with standard fibre 
and polarization control 19 . Bob, by virtue of his fibre UTBA, then measures his 
time-bin qubit in a randomly chosen basis y. To the best of our knowledge, these 
UTBAs enable for the first time projection measurements of time-bin qubits in 
arbitrary bases, which facilitates the implementation of the fair protocol and of all 
the cheating strategies. We characterized the quality of our source by measuring 
entanglement visibilities of at least (91.0 ± 2.8)%. 
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We performed sequential coin flipping either with the BB84 or the fair 
states, in both cases with honest players or one cheater, as determined by the set- 
tings of the UTBAs. Let us consider the honest cases first. We measured the error 
rate P* and the probabilities P and Pi of outcomes c = and 1 per coincidence 
detection (which we define as a coin-flip instance). As shown on Fig. 3-a, the P* 
obtained when using either the BB84 or the fair states is smaller than 2%, i.e. less 
than the lowest error rate that a cheater would theoretically induce by cheating on 
every single coin flip (> 7.3% for the BB84 states and 10% for the fair states). 
This ensures that cheating is noticeable over several coin flips. Furthermore, the 
outcome probabilities P and Pi are equal within one standard deviation, which 
demonstrates that the protocol does indeed result in unbiased bits in the honest 
case. 

Next we consider the cases where either Alice or Bob tries to fix the out- 
come c of every coin flip. The cheater's UTBA was aligned for optimal cheating. 
For each instance, we let the cheater choose a desired value for c, uniformly dis- 
tributed. After many coin-flip instances, we measured the probability P A (P B ) for 
Alice (Bob) to fix the outcome to the desired value, as well as P*. We assumed 
that a cheating Bob would always declare a mismatch when he was unhappy with 
the outcome. 

As a first observation of the results presented on Fig. 3-b and 3-c, we note 
that the values obtained for Pa and Pb equal, within one standard deviation, the 
theoretical maximum minus the error rate P* measured in the honest case, which 
indicates that the UTBAs were well aligned for each case. Next, as shown on 
Fig. 3-b, we see that the BB84 states are clearly unfair as Pa is higher than P B . 



8 



As a result, the error rate for a cheating Alice is less than for a cheating Bob. 
On Fig. 3-c, we see that this asymmetry is removed when using the fair states. 
Indeed, Pa and P B are now equal within one standard deviation. Furthermore, 
when using the BB84 states, P A = (91.1 ± 0.1)%, which is significantly higher 
than 90%, i.e. we are able to show that Alice can indeed cheat better than what 
is theoretically possible with the fair states. Similarly, when using the fair states, 
P B = (88.4 ± 0.1)% > 85.4%, which demonstrates that Bob can cheat better 
than what is theoretically possible with the BB84 states. Finally, we note that the 
error rate P* increases from less than 2% to at least 8.9% when moving from the 
honest case to the case where one player always tries to cheat optimally. This 
clearly shows that the cheater is revealed over many coin-flip instances and the 
sequential coin-flipping protocol proposed here can be implemented with current 
technology. 

Methods Summary 

The pump laser was operated at a repetition rate of 10 MHz (see Fig. 2). The 
10 mm long PPLN crystal, with a 7.05 um grating period, was heated to 176°C. 
The mean number of photon pairs created per pump pulse was about 0.05, which 
set the probabilities to create one and two pairs to 4.8% and 0.12%, respectively 20 . 

Detection events were acquired by a time to digital converter (TDC), which 
measures delays between a start signal and several stop signals. The detection sig- 
nals from Alice's free-running Si-based single photon detectors were pre-processed 
with an electronic mixer (see Fig. 2). The trigger signal was generated when a de- 
tection at either Si or S 2 occurred. It emerged synchronously with the laser clock 
(elk). The signal was used to gate Bob's InGaAs-based single photon detectors 
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during a 7 ns activation window. The signal ready, which was emitted only when 
both detectors were ready to detect, was used to start the TDC. This ensures that 
the statistics were not biased by the dead-time of Bob's detectors. The detections 
at Ii and I 2 , as well as the signal S 2 A elk and Si V S 2 served as stop signals, 
where A denotes the logical AND and V the logical OR. This allowed us to reg- 
ister all possible coincidence detection events, where the detection slots, early, 
middle and late, were narrowed down to 400 ps. This particular event selection 
to retrieve information about detections at Si and S 2 was chosen due to hardware 
considerations in Alice's mixer. 

Methods 

Requirements on Alice's source of qubits. The adversarial nature of the players 
forces Alice to consider side channels that a cheating Bob could exploit. For 
instance, when using attenuated laser pulses or a heralded single photon source 16 , 
Alice will sometimes send multiple photons. In this case, all photons would be 
prepared in the same qubit state \ip x ,a}- In the presence of loss, this allows a 
cheating Bob to declare that the photon was lost unless he detects two photons 
in different bases using his honest measuring apparatus. When this happens, Bob 
can conclusively determine Alice's bit 64% of the time (with the fair states), in 
which case only will he declare the photon detected, thereby completely breaking 
the protocol 14 . To prevent this, Alice could use a perfect source of single photons. 
However, this is not practical with current technology. A more realistic choice is 
to use a source of maximally entangled photonic qubits for which a projection at 
Alice's remotely prepares a state at Bob's 17 . Should the source emit multiple pairs 
of entangled qubits, the state of the qubits sent to Bob are uncorrelated, hence Bob 
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cannot gain any information from multi-pair events. 

Universal time-bill analysers The free-space universal time-bin analyser 21 
(UTBA) shown in Fig. 2 can be understood as follows (it will be described in 
details elsewhere, F. B., J. A. S., N. G., & W. T., in preparation). The polarization 
of the incident time -bin qubit is first rotated to 45° with respect to the linear po- 
larization transmitted by the input polarizing beamsplitter (PBS). After passing 
through an interferometer with large path length difference, the qubit emerges in 
three chronologically ordered times slots separated by 1 .4 ns that we label early, 
middle and late. In the middle slot, the initial time-bin qubit is mapped on a po- 
larization qubit, which can be analysed in any basis using standard waveplates, a 
PBS and detectors. This implements the detection in the x = 1 basis at Alice's, 
where the angle <p is determined by the orientation of the half-wave plate (HWP) 
located at the output of the interferometer. Detection in the early (late) slots cor- 
responds to a projection on \c)a (\£)a), and this implements a measurement in the 
x = basis. Therefore, the detection time at the single photon detectors Si and 
S 2 determines Alice's basis. This is similar to previous projection measurement 
schemes for time-bin qubits 22 , yet without the restriction to mutually unbiased 
bases. 

Bob's fibre UTBA is the fibre optics equivalent of the free-space version. 
The input fibre, as well as the two arms of the interferometer, are made of PM 
fibre. The output of the interferometer is a standard fibre and the angle (p is se- 
lected by a polarization controller. Here again, the detection time at the single 
photon detectors h and I 2 determines Bob's basis. 

Entanglement visibility and phase alignment To measure the entanglement vis- 
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ibility, we first set the free-space UTBA to project on the states |e) ± e ta \£) and 
the fibre UTBA to project on |e) ± e i/3 |£), where a and (3 are unknown phases (we 
omitted normalization). Then, for a given detection at one of Alice's detectors 
Si, the probability p {j for a coincident detection in one of Bob's detectors Ij was 
measured while the phase a of the free-space UTBA was scanned by displacing 
the piezo-actuated retroreflector of the long arm. This caused the usual sinusoidal 
variation of pij from which visibilities > (91.0 ± 2.8)% were measured. We ad- 
justed a to maximize pu, indicating that Alice's and Bob's UTBAs are preparing 
and measuring in the same basis, i.e. a = (3. This alignment procedure preceded 
each data collection run. 
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Figure 1 Honest and cheating states of the loss-tolerant protocol. The states 
used are represented on a great circle of the Bloch sphere, a) BB84 states, cor- 
responding cheating states \A ) and \Ai) for Alice, equal to \(p^} and |<^) with 
Pa = 67.5°, and corresponding cheating states \B ) and \Bi) for Bob, equal to 
and \ipg) with ips = 22.5°. b) Fair states and the corresponding cheating 
states defined as for the BB84 states but with ip A « 63.4° and ip B « 18.4°. 

Figure 2 Experimental setup. A laser diode sends 50 ps pulses at 530.6 nm 
wavelength through an interferometer with path length difference equivalent to 
1 .4 ns travel time difference. The pulses emerge in an even superposition of two 
well defined time-bins that we label the early and late bins and then propagate into 
a non-linear, periodically poled lithium niobate crystal (PPLN), thereby creating 
time-bin entangled qubits at 807 and 1546 nm wavelengths through spontaneous 
parametric downconversion. The two qubits are separated at the dichroic mirror 
(DM). As explained in the Methods, the free-space and fibre UTBAs randomly 
project Alice's and Bob's qubits onto one of the four states defined in ([[]), where 
if is selected by the orientation of the output half-wave plate (HWP) at Alice's 
and the polarization controller at Bob's. The coincidence detections are monitored 
using a time-domain converter (TDC) and analysed in real time. 

Figure 3 Experimental results of sequential coin flipping. The column plots 
show the a) honest player cases, b) one cheater cases with BB84 states, c) one 
cheater cases with fair states. All data collection runs consisted of at least 80 
thousand coin-flip instances. The one-standard-deviation uncertainties on P , Pi, 
Pa and Pb are at most 0.15%. The uncertainty on P* is at most 0.04% in the 
honest cases and at most 0.13% in the cases where one player cheats. 
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Figure 1: 



a) BB84 states: ip = 45° b) Fair states: ip fs 36.9° 
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